Threat database

CVE-2026-105611 is an improper authorization vulnerability in chillzhuang SpringBlade versions 5.0.0 and 5.0.1. It affects a function in the User Detail Endpoint within the RoleController.java file. The vulnerability allows remote attackers to manipulate an argument ID, bypassing authorization controls. The issue was reported early to the project but remains unaddressed. The vulnerability has a medium severity rating with a CVSS score of 5.1. Exploit details have been publicly disclosed but no known exploitation in the wild has been reported.

A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument initPassword results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of the argument userId causes authorization bypass. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. CVE-2026-56100 and CVE-2026-36765 are distinct issues. The vendor was contacted early about this disclosure but did not respond in any way.